evolix/ansible-roles
22
2
Fork 2
Code Issues 61 Pull requests 18 Releases 33 Wiki Activity

Adapte le check minifirewall pour le cas systemd
All checks were successful
continuous-integration/drone/push Build is passing
Details

Browse source
This commit is contained in:
William Hirigoyen (Evolix) 2022-05-11 17:46:08 +02:00
parent 9973a62c16
commit 36ed916b96
1 changed files with 19 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
minifirewall/files/check_minifirewall
View file

@ -10,29 +10,37 @@ is_alert5_enabled() {
if test -f /etc/init.d/alert5; then if test -f /etc/init.d/alert5; then
test -f /etc/rc2.d/S*alert5 test -f /etc/rc2.d/S*alert5
else else
systemctl is-enabled alert5 -q systemctl is-active alert5 | grep -q "^active$"
fi fi
} }
is_minifirewall_enabled() { is_minifirewall_enabled() {
# TODO: instead of nested conditionals, we could loop with many possible paths # TODO: instead of nested conditionals, we could loop with many possible paths
# and grep the first found, or error if none is found # and grep the first found, or error if none is found
if test -f /etc/rc2.d/S*alert5; then if [ -f /etc/systemd/system/minifirewall.service ]; then
grep -q "^/etc/init.d/minifirewall" /etc/rc2.d/S*alert5 systemctl is-enabled minifirewall 2>&1 > /dev/null
else else
if test -f /usr/share/scripts/alert5.sh; then if test -f /etc/rc2.d/S*alert5; then
grep -q "^/etc/init.d/minifirewall" /usr/share/scripts/alert5.sh grep -q "^/etc/init.d/minifirewall" /etc/rc2.d/S*alert5
else else
return_critical "No Alert5 scripts has been found." if test -f /usr/share/scripts/alert5.sh; then
grep -q "^/etc/init.d/minifirewall" /usr/share/scripts/alert5.sh
else
return_critical "No Alert5 scripts has been found."
fi
fi fi
fi fi
} }
is_minifirewall_started() { is_minifirewall_started() {
if test -x /usr/share/scripts/minifirewall_status; then if [ -f /etc/systemd/system/minifirewall.service ]; then
/usr/share/scripts/minifirewall_status > /dev/null systemctl is-active minifirewall 2>&1 > /dev/null
else else
/sbin/iptables -L -n | grep -q -E "^(DROP\s+udp|ACCEPT\s+icmp)\s+--\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0\s*$" if test -x /usr/share/scripts/minifirewall_status; then
/usr/share/scripts/minifirewall_status > /dev/null
else
/sbin/iptables -L -n | grep -q -E "^(DROP\s+udp|ACCEPT\s+icmp)\s+--\s+0\.0\.0\.0\/0\s+0\.0\.0\.0\/0\s*$"
fi
fi fi
} }
@ -61,9 +69,9 @@ main() {
fi fi
else else
if is_minifirewall_started; then if is_minifirewall_started; then
return_warning "Minifirewall is started, but disabled in alert5." return_warning "Minifirewall is started, but disabled in alert5 or systemd."
else else
return_ok "Minifirewall is not started, but disabled in alert5." return_ok "Minifirewall is not started, but disabled in alert5 or systemd."
fi fi
fi fi
else else